Luke Taylor
90304f64c6
Update version for 3.0.5 release
2010-11-18 12:36:08 +00:00
Luke Taylor
e80853b698
SEC-1412: DefaultSavedRequest should ignore "If-Modified-Since" headers to prevent re-displaying the login form (the cached result of the original request).
2010-11-15 16:48:15 +00:00
Luke Taylor
82d105cbc3
SEC-1587: Add explicit call to removeAttribute() to remove the context from the session if the current context is empty or anonymous.
...
Allows for the situation where a user is logged out without invalidating the session.
2010-11-10 13:01:49 +00:00
Luke Taylor
e88f47a96a
SEC-1561: Add check on whether the security context attribute is set in the current session to make sure it is stored when a new session has been created during the request.
2010-11-10 12:53:56 +00:00
Rob Winch
0bdc9c176b
SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward
2010-11-03 14:25:52 -05:00
Luke Taylor
71b2af31ee
SEC-1608: Make sure FirewalledRequest.reset() is called when filter="none"
2010-11-02 12:19:22 +00:00
Luke Taylor
3cfe23f60d
Update versions to 3.0.5.CI-SNAPSHOT
2010-10-26 15:32:22 +01:00
Luke Taylor
82d140ffb1
Version 3.0.4.RELEASE
2010-10-26 15:32:22 +01:00
Luke Taylor
1563491322
SEC-1600: Added Implementation-Version and Implementation-Title to manifest templates and checking of version numbers in namespace config module and core. Config checks the version of core it is running against and core checks the Spring version, reporting any mismatches or situations where the app is running with less than the recommended Spring version.
2010-10-26 15:32:21 +01:00
Luke Taylor
b688bb69ee
SEC-1543: Change IpAddressMatcher to return false when comparing an Inet6Address with an Inet4Address rather than raising an exception.
2010-10-26 15:32:21 +01:00
Luke Taylor
8e68fa1334
SEC-1584: Added namespace support for injecting custom HttpFirewall instance into FilterChainProxy.
2010-10-26 15:32:21 +01:00
Luke Taylor
ed9411c660
SEC-1584: Addition of HttpFirewall strategy to FilterChainProxy to reject un-normalized requests and wrap the incoming request object before processing by the security filter chain to provide a more consistent representation of paths than is guaranteed by the servlet spec. The wrapper strips path parameters from pathInfo and servletPath to provide consistency of URL matching across servlet containers and protect against bypassing security constraints by the malicious addition of such parameters to the URL. The paths are canonicalized further by replacing of multiple sequences of "/" characters with a single "/".
2010-10-26 15:31:33 +01:00
Luke Taylor
25d222208d
Switch version to 3.0.4-CI-SNAPSHOT.
2010-07-01 00:37:55 +01:00
Luke Taylor
9b0c21dfef
3.0.3 release. Update version in build files.
2010-07-01 00:37:29 +01:00
Luke Taylor
1872d94aa1
Porting gradle changes from master
2010-06-30 20:45:03 +01:00
Luke Taylor
80ccd2b285
SEC-1501: Fix bean classname in Javadoc for SwitchUserFilter.
2010-06-25 13:36:52 +01:00
Luke Taylor
21a664b2eb
Deprecation warning suppression for UserMap.
2010-06-25 12:50:58 +01:00
Luke Taylor
09aba3906c
SEC-1496: Added support for use of any non-standard URL schemes in DefaultRedirectStrategy.
2010-06-18 03:34:13 +01:00
Luke Taylor
57cfff6f5c
SEC-1500: Convert AbstractRetryEntryPoint to use requestURI to correctly encode URLs.
2010-06-18 01:33:38 +01:00
Luke Taylor
aaa7bd90b2
SEC-1481: Updated constructors of Authentication types to use a generic wildcard for authorities collection.
2010-05-21 16:02:25 +01:00
Luke Taylor
6d6c2d31ef
SEC-1462: Only apply session fixation protection strategy if request.isRequestedSessionIdValid() returns true. We don't need to create a new session if the current one already has a different Id from the client.
2010-04-20 18:04:56 +01:00
Luke Taylor
0760bb947b
SEC-1458: Remove logger field in HttpSessionEventPublisher in favour of direct lookup. Prevents early initialization of logging system when listener is initialized.
2010-04-16 16:13:41 +01:00
Luke Taylor
b8e50c0933
SEC-1439: Make getters and setters public on HttpRequestResponseHolder.
...
Necessary to allow use of custom SecurityContextRepository.(cherry picked from commit d5df53f1dbfcbe274656cce4e7a2e064f8db1597)
2010-03-12 15:54:12 +00:00
Luke Taylor
677576ea8b
SEC-1429: Fix test. Wasn't setting allowSessionCreation=false on failure handler.
2010-03-11 02:30:37 +00:00
Luke Taylor
1b0ac9c785
Porting of gradle changes from master.
2010-03-11 02:15:02 +00:00
Luke Taylor
5a5b62e2cb
SEC-1429: Removed cached authentication from session after successful authentication.(cherry picked from commit 43f0e111067dec72f2a496ad7d9df9fc10de43dc)
2010-03-05 00:11:08 +00:00
Luke Taylor
6ac8588144
Fix to Javadoc for AbstractAuthenticationProcessingFilter.(cherry picked from commit a3263753d93bba781471135448c4de5564fe464a)
2010-03-04 22:07:30 +00:00
Luke Taylor
5690f1c581
SEC-1428: Check if response has been committed before redirecting to target URL in AbstractAuthenticationTargetUrlRequestHandler.
2010-03-04 22:00:37 +00:00
Luke Taylor
87cf27ab7c
SEC-1429: Move logic for saving of AuthenticationException into the SimpleUrlAuthenticationFailurehandler from AbstractAuthenticationProcessingFilter. It will also now use request scope if configured to do a forward instead of a redirect.
2010-03-04 21:49:38 +00:00
Luke Taylor
a7e21318bf
SEC-1425: Replace use of Java 1.6 String.isEmpty().
2010-03-04 00:52:54 +00:00
Luke Taylor
b46ae6ac62
SEC-1425: Add check for empty cookie in AbstractRememberMeServices.
...
Prevents ArrayOutOfBoundsException later when processing the tokeniszed cookie.
2010-02-28 14:00:43 +00:00
Luke Taylor
9831980bc2
Update versions to 3.0.3.CI-SNAPSHOT.
2010-02-26 15:04:43 +00:00
Luke Taylor
44f45d21f0
3.0.2 release. Update version in build files.
2010-02-19 01:22:21 +00:00
Luke Taylor
14ae36ac3b
SEC-1412: Modify DefaultSavedRequest to ignore If-Not-Matched header.
...
The browser (or at least Firefox) does not send it after a redirect, and it causes problems with Spring's ShallowEtagHeaderFilter if it is stored and returned by the saved request.
2010-02-18 00:32:49 +00:00
Luke Taylor
bd635edc31
SEC-1410: Makes sure usernames which are OpenID https identities are detected as well as http ones.
...
Using ":" as the token delimiter means we accidentally mistake the URL for two tokens. This had previously been fixed for http URLs but not https ones.
2010-02-15 22:46:18 +00:00
Luke Taylor
c1133d1ef3
Removed unused import in DelegatingAuthenticationEntryPoint and corrected test class name.
2010-02-14 23:31:31 +00:00
Luke Taylor
d30e31d816
Remove unnecessary @SuppressWarnings and inline dependency from ELRequestMatcher (util package) to core ExpressionUtils.
2010-02-14 23:29:27 +00:00
Luke Taylor
c12c43da9e
Javadoc fixes.
2010-02-14 23:27:09 +00:00
Luke Taylor
36612377e2
Replace package.html with package-info.java files, creating new ones where missing and updating outdated contents.
2010-02-14 23:23:23 +00:00
Luke Taylor
1e4f451352
Moved DelegatingAuthenticationEntryPointTest-context.xml to test/resources
2010-02-11 18:08:06 +00:00
Luke Taylor
dcbdfc2026
SEC-1396: Implement eager saving of SecurityContext in SessionManagementFilter on authentication.
...
The user is then seen as being authenticated to further (re-entrant) requests which occur before the existing request has completed. The saving logic is contained with the SecurityContextRepository implementation.
2010-02-11 17:47:22 +00:00
Mike Wiesner
90d6ff1fde
SEC-1406: Create a DelegatingAuthenticationEntryPoint
2010-02-11 13:19:16 +01:00
Mike Wiesner
d32b078a8c
SEC-1406: Create a DelegatingAuthenticationEntryPoint
2010-02-11 09:05:28 +01:00
Mike Wiesner
d2413cf237
SEC-1406: Create a DelegatingAuthenticationEntryPoint
2010-02-10 21:25:23 +01:00
Luke Taylor
08c7155ab5
SEC-1404: Refactored IP subnet matching into IpAddressMatcher class to allow it to be used outside expressions.
2010-02-10 15:06:01 +00:00
Luke Taylor
1ecd3e228b
SEC-1405: added RequestMatcher interface.
2010-02-10 14:34:14 +00:00
Luke Taylor
984604b026
SEC-1384: Removed check for empty authority list from DefaultWebInvocationPrivilegeEvaluator.
...
The class previously rejected access if the user had no authorities. It will now allow the AccessDecisionManager to make the decision.
2010-02-06 14:38:44 +00:00
Luke Taylor
0974e21fb6
SEC-1379: Added creation of a session if session timeout is detected (requested session ID is invalid).
...
This prevents problems with repeated detection of the same invalid session when the redirected request comes in.
2010-01-23 02:12:30 +00:00
Luke Taylor
04447bdbf0
SEC-1377: Extended HTML escaping functionality to take account of control characters, whitespace and to handle Unicode supplementary characters (surrogate pairs).
2010-01-22 01:55:13 +00:00
Luke Taylor
0c10efbbf8
Revert SEC-1356.
...
Checking the path of a submitted cookie will never work as the path is not sent by the browser, so will be null.
2010-01-19 22:26:21 +00:00
